fedipod-server 0.29.0 → 0.31.0

package/lib/connections/import.mjs

@@ -1,357 +0,0 @@
-// import.mjs — bring a non-FediPod account's exports in: the CSV files a
-// Mastodon-family server hands its leaver (follows, blocks, mutes, lists,
-// domain blocks; Misskey's exports are the same shapes). Parsing is here;
-// application runs in a paced worker owned by the agent, because most rows
-// cost network requests — a handle has to be resolved to its actor before
-// anything can be followed, blocked or muted — and a migration-sized list
-// applied at full speed is a flood aimed at every server it names.
-//
-// The state document is shared with stage() and clear(), which run from the
-// admin route while a row is in flight — so nothing here holds a copy of it
-// across a network await. Every mutation is read-modify-write against a fresh
-// read, and a row that finished travelling is committed only if its record is
-// still there and still pending.
-
-import crypto from 'node:crypto';
-import { lookupWebFinger, selfLink, confirmDelegation, followActor, unfollowActor } from '../core/social.mjs';
-
-export const IMPORT_STATE_DOC = 'import-state.json';
-export const IMPORT_KINDS = ['follow', 'block', 'mute', 'list', 'domain'];
-
-const TICK_MS = 400;          // one network row per tick at most
-const FOLLOW_GAP_MS = 1000;   // follows also deliver, so they go slower
-const PUBLISH_EVERY = 25;     // follows between collection republishes
-const MAX_ROWS = 25_000;      // staged-row cap: the doc is rewritten per row
-
-// A real CSV parse — quoted fields, doubled quotes, CRLF — because a list
-// title may contain a comma and a display name may contain anything.
-export function parseCsv(text) {
-  const rows = [];
-  let row = [], field = '', q = false;
-  const endField = () => { row.push(field); field = ''; };
-  const endRow = () => { endField(); if (row.some(f => f !== '')) rows.push(row); row = []; };
-  for (let i = 0; i < text.length; i++) {
-    const c = text[i];
-    if (q) {
-      if (c === '"') { if (text[i + 1] === '"') { field += '"'; i++; } else q = false; }
-      else field += c;
-    } else if (c === '"') q = true;
-    else if (c === ',') endField();
-    else if (c === '\n' || c === '\r') { if (c === '\r' && text[i + 1] === '\n') i++; endRow(); }
-    else field += c;
-  }
-  endRow();
-  return rows;
-}
-
-const HANDLE = /^[^@\s]+@[^@\s]+$/;
-const DOMAIN = /^[a-z0-9-]+(\.[a-z0-9-]+)+$/i;
-const cleanHandle = (s) => String(s || '').trim().replace(/^@/, '');
-
-// CSV text → normalized row values for one kind. Header and comment rows are
-// recognized only where they can exist — a LIST title is free text and may
-// legitimately start with '#' or say anything. Invalid rows come back counted,
-// with the first few quoted so a mis-picked file is obvious.
-export function normalizeImport(kind, text) {
-  if (!IMPORT_KINDS.includes(kind)) throw new Error(`unknown import kind: ${kind}`);
-  const rows = parseCsv(String(text || ''));
-  const values = [];
-  const invalid = [];
-  for (const cols of rows) {
-    const first = String(cols[0] || '').trim();
-    if (!first) continue;
-    if (kind !== 'list' && /^#/.test(first)) continue;                          // comment
-    if (kind !== 'list' && kind !== 'domain' && /account address/i.test(first)) continue;  // header
-    if (kind === 'domain') {
-      const d = first.toLowerCase();
-      if (DOMAIN.test(d)) values.push(d); else invalid.push(first);
-    } else if (kind === 'list') {
-      const handle = cleanHandle(cols[1]);
-      if (first && HANDLE.test(handle)) values.push({ value: handle, list: first });
-      else invalid.push(cols.join(','));
-    } else {
-      const handle = cleanHandle(first);
-      if (HANDLE.test(handle)) values.push(handle); else invalid.push(first);
-    }
-  }
-  return { values, invalid };
-}
-
-// The paced applier. One instance per agent, armed only while the agent is
-// active — startActive/requestTakeover resume it, demote stops it — and each
-// tick re-checks the lease and the pod's backoff before touching anything.
-export class ImportWorker {
-  constructor({ agent, log }) {
-    this.agent = agent;
-    this.log = log || (() => {});
-    this.timer = null;
-    this.busy = false;
-    this.lastFollowAt = 0;
-  }
-
-  state() { return this.agent.store.read(IMPORT_STATE_DOC, null); }
-
-  // Add parsed rows to the run. Rows already staged, already applied, or
-  // already following are counted out rather than re-queued, so re-running
-  // the same file is a no-op. The cap keeps the per-row rewrite bounded.
-  stage(kind, values) {
-    const agent = this.agent;
-    const st = this.state() || { startedAt: new Date().toISOString(), rows: [] };
-    delete st.completedAt;                     // a new batch reopens the run
-    const key = (r) => [r.kind, r.list || '', r.value].join(' ');
-    const have = new Set(st.rows.map(key));
-    const following = new Set(agent.store.getContacts().following.map(f => f.handle).filter(Boolean));
-    const domains = new Set(agent.store.getBlocklist().domains);
-    let staged = 0, duplicate = 0, already = 0, refused = 0;
-    for (const v of values) {
-      const row = typeof v === 'string' ? { kind, value: v } : { kind, ...v };
-      row.status = 'pending';
-      if (have.has(key(row))) { duplicate++; continue; }
-      if (kind === 'follow' && following.has(row.value)) { already++; continue; }
-      if (kind === 'domain' && domains.has(row.value)) { already++; continue; }
-      if (st.rows.length >= MAX_ROWS) { refused++; continue; }
-      have.add(key(row));
-      st.rows.push(row);
-      staged++;
-    }
-    agent.store.write(IMPORT_STATE_DOC, st);
-    if (staged) this.start();
-    return { staged, duplicate, already, refused, total: st.rows.length };
-  }
-
-  progress() {
-    const st = this.state();
-    const prior = st?.doneCount || 0;
-    if (!st?.rows?.length && !prior) return { rows: 0, pending: 0, done: 0, failed: 0, running: !!this.timer };
-    const byKind = {};
-    let pending = 0, done = prior, failed = 0;
-    for (const r of st.rows) {
-      const k = (byKind[r.kind] ||= { pending: 0, done: 0, failed: 0 });
-      k[r.status]++;
-      if (r.status === 'pending') pending++;
-      else if (r.status === 'done') done++;
-      else failed++;
-    }
-    return {
-      rows: st.rows.length + prior, pending, done, failed, byKind,
-      running: !!this.timer, startedAt: st.startedAt, completedAt: st.completedAt || null,
-      failures: st.rows.filter(r => r.status === 'failed').slice(0, 100)
-        .map(r => ({ kind: r.kind, value: r.value, ...(r.list ? { list: r.list } : {}), reason: r.reason })),
-    };
-  }
-
-  clear() {
-    this.stop();
-    this.agent.store.write(IMPORT_STATE_DOC, { rows: [] });
-  }
-
-  // Called from startActive and after a takeover: pick a stranded run back
-  // up. Any unclosed run arms the timer — rows still pending, or a final
-  // publish that never landed.
-  resume() {
-    const st = this.state();
-    if (!st?.rows?.length || st.completedAt) return;
-    this.start();
-  }
-
-  start() {
-    if (this.timer) return;
-    this.timer = setInterval(() => this.tick().catch(e => this.log(`import tick: ${e.message}`)), TICK_MS);
-    this.timer.unref?.();     // a browser's setInterval returns a number
-  }
-
-  stop() {
-    clearInterval(this.timer);
-    this.timer = null;
-  }
-
-  async tick() {
-    if (this.busy) return;
-    this.busy = true;
-    try {
-      const agent = this.agent;
-      const st = this.state();
-      if (!st?.rows) { this.stop(); return; }
-      // A parked or moved actor runs no import: parking mass-unfollows and a
-      // move hands the account on — the worker must not pull against either.
-      const cfg = agent.store.getConfig?.() || {};
-      if (cfg?.quiescedAt || cfg?.movedTo) { this.stop(); return; }
-      const next = st.rows.find(r => r.status === 'pending');
-      if (!next) {
-        if (!st.completedAt) await this.finish();
-        else this.stop();
-        return;
-      }
-      if (agent.viewer) return;                                  // demoted mid-run
-      if (agent.lease && !agent.lease.stillHeld()) return;       // another device is acting
-      if (agent.remote?.pausedUntil > Date.now()) return;        // the pod asked for quiet
-      if (next.kind === 'follow' && Date.now() - this.lastFollowAt < FOLLOW_GAP_MS) return;
-      if (next.kind === 'domain') {
-        // Free rows — no resolution, no delivery — the whole batch lands in
-        // one tick. No awaits between the read and the write, so no race.
-        const b = agent.store.getBlocklist();
-        const fresh = this.state();
-        if (!fresh?.rows) return;
-        for (const r of fresh.rows) {
-          if (r.status !== 'pending' || r.kind !== 'domain') continue;
-          if (!b.domains.includes(r.value)) b.domains.push(r.value);
-          r.status = 'done';
-        }
-        agent.store.setBlocklist(b);
-        agent.store.write(IMPORT_STATE_DOC, fresh);
-        return;
-      }
-      // The network happens here, touching no state document; the verdict is
-      // committed against a FRESH read afterwards, so rows staged or cleared
-      // while this one travelled are never overwritten.
-      const outcome = await this.applyRow(next);
-      if (outcome) this.commitRow(next, outcome);
-      if (outcome?.followed && (this.state()?.followsSincePublish || 0) >= PUBLISH_EVERY) {
-        await agent.publisher.publishCollections({ following: true, pending: true });
-        const after = this.state();
-        if (after) { after.followsSincePublish = 0; agent.store.write(IMPORT_STATE_DOC, after); }
-      }
-    } finally { this.busy = false; }
-  }
-
-  // Record one travelled row's verdict. Fresh read; the row is matched by
-  // content — if clear() dropped it or a duplicate check superseded it while
-  // it was in flight, there is nothing to record and nothing is written.
-  commitRow(row, outcome) {
-    const st = this.state();
-    const match = st?.rows?.find(r => r.status === 'pending' && r.kind === row.kind
-      && r.value === row.value && (r.list || '') === (row.list || ''));
-    if (!match) return;
-    match.status = outcome.status;
-    if (outcome.reason) match.reason = outcome.reason;
-    if (outcome.followed) st.followsSincePublish = (st.followsSincePublish || 0) + 1;
-    if (outcome.blocked) st.blocksApplied = true;
-    this.agent.store.write(IMPORT_STATE_DOC, st);
-  }
-
-  // handle → { id, inbox } — the lean resolve: WebFinger, one actor fetch,
-  // the delegation round-trip, and nothing else. A handle we already follow
-  // answers from contacts without touching the network, and the blocklist is
-  // honored the same way the interactive resolve honors it.
-  async resolve(clean, { forBlock = false } = {}) {
-    const agent = this.agent;
-    const host = clean.slice(clean.lastIndexOf('@') + 1);
-    if (agent.store.isBlocked(`https://${host}/`)) throw new Error('domain is blocked');
-    const known = agent.store.getContacts().following.find(f => f.handle === clean && f.actor);
-    if (known) return { id: known.actor, inbox: known.inbox };
-    const jrd = await lookupWebFinger('acct:' + clean);
-    const href = selfLink(jrd)?.href;
-    if (!href) throw new Error('webfinger found no actor');
-    const doc = await agent.intake.fetchAP(href);
-    if (!doc?.id) throw new Error('actor document unusable');
-    if (!forBlock && agent.store.isBlocked(doc.id)) throw new Error('actor is blocked');
-    await confirmDelegation(clean.slice(clean.lastIndexOf('@') + 1), doc);
-    return doc;
-  }
-
-  // One row's whole journey, returned as a verdict — never written here.
-  // null means "no verdict": the pod's backoff interrupted it, and the row
-  // stays pending for after the pause.
-  async applyRow(row) {
-    const agent = this.agent;
-    const done = (extra = {}) => ({ status: 'done', ...extra });
-    try {
-      if (row.kind === 'follow') {
-        this.lastFollowAt = Date.now();
-        if (agent.store.getContacts().following.some(f => f.handle === row.value)) {
-          return done({ reason: 'already following' });
-        }
-        const doc = await this.resolve(row.value);
-        if (agent.store.getContacts().following.some(f => f.actor === doc.id)) {
-          return done({ reason: 'already following' });
-        }
-        // followActor records the contact BEFORE delivering, which is what
-        // lets the Accept that comes back seconds later find its record.
-        await followActor(agent, doc.id, { publish: false, doc });
-        const contacts = agent.store.getContacts();
-        const rec = contacts.following.find(f => f.actor === doc.id);
-        if (rec && !rec.handle) { rec.handle = row.value; agent.store.setContacts(contacts); }
-        return done({ followed: true });
-      }
-      if (row.kind === 'block') {
-        const host = row.value.slice(row.value.lastIndexOf('@') + 1);
-        const b = agent.store.getBlocklist();
-        if (b.domains.some(d => host === d || host.endsWith('.' + d))) {
-          return done({ reason: 'domain already blocked' });
-        }
-        const doc = await this.resolve(row.value, { forBlock: true });
-        const b2 = agent.store.getBlocklist();
-        if (b2.actors.includes(doc.id)) return done({ reason: 'already blocked' });
-        b2.actors.push(doc.id);
-        agent.store.setBlocklist(b2);
-        if (agent.store.getContacts().following.some(f => f.actor === doc.id)) {
-          await unfollowActor(agent, doc.id).catch(() => {});
-        }
-        return done({ blocked: true });
-      }
-      if (row.kind === 'mute') {
-        const doc = await this.resolve(row.value);
-        const m = agent.store.getMuted();
-        if (m.actors.includes(doc.id)) return done({ reason: 'already muted' });
-        m.actors.push(doc.id);
-        agent.store.setMuted(m);
-        return done();
-      }
-      if (row.kind === 'list') {
-        const doc = await this.resolve(row.value);
-        const lists = agent.store.getLists();
-        let l = lists.find(x => x.title === row.list);
-        if (!l) {
-          l = { id: crypto.randomBytes(8).toString('hex'), title: row.list, repliesPolicy: 'list', members: [] };
-          lists.push(l);
-        }
-        if ((l.members || []).includes(doc.id)) return done({ reason: 'already on the list' });
-        l.members = [...(l.members || []), doc.id];
-        agent.store.setLists(lists);
-        return done();
-      }
-      return { status: 'failed', reason: `unknown kind ${row.kind}` };
-    } catch (e) {
-      if (agent.remote?.pausedUntil > Date.now()) return null;
-      return { status: 'failed', reason: e.message };
-    }
-  }
-
-  // Everything applied: the batched republishes, once, then the record closes
-  // — done rows pruned to a count so a long run's record stays small, failed
-  // rows kept until --clear so they can be read. A publish the pod refuses
-  // leaves the run open; a restart or the next batch retries it. A batch that
-  // landed while the publishes were in flight keeps the run open too.
-  async finish() {
-    const agent = this.agent;
-    let st = this.state();
-    if (!st?.rows) { this.stop(); return; }
-    if (st.rows.some(r => r.status === 'pending')) return;
-    try {
-      if (st.followsSincePublish) {
-        await agent.publisher.publishCollections({ following: true, pending: true });
-        const s = this.state();
-        if (s) { s.followsSincePublish = 0; agent.store.write(IMPORT_STATE_DOC, s); }
-      }
-      if (this.state()?.blocksApplied) {
-        await agent.publisher.publishCollections({ blocked: true });
-        const s = this.state();
-        if (s) { s.blocksApplied = false; agent.store.write(IMPORT_STATE_DOC, s); }
-      }
-    } catch (e) {
-      this.log(`import: final publish failed: ${e.message} — retried on restart or the next batch`);
-      this.stop();
-      return;
-    }
-    st = this.state();
-    if (!st?.rows || st.rows.some(r => r.status === 'pending')) return;
-    const doneNow = st.rows.filter(r => r.status === 'done').length;
-    const failed = st.rows.filter(r => r.status === 'failed').length;
-    st.doneCount = (st.doneCount || 0) + doneNow;
-    st.rows = st.rows.filter(r => r.status !== 'done');
-    st.completedAt = new Date().toISOString();
-    agent.store.write(IMPORT_STATE_DOC, st);
-    this.log(`import finished: ${st.doneCount} applied, ${failed} failed`);
-    this.stop();
-  }
-}

package/lib/connections/tagfeed.mjs

@@ -1,212 +0,0 @@
-// tagfeed.mjs — topical firehose for a single-actor instance: polls public
-// no-auth hashtag timelines on a configured instance and mirrors NEW notes
-// into the statuses index as kind 'tag'. View cache only — tag content is
-// NOT written to the pod; the pod holds followed/own content.
-//
-// Config in tagfeed.json: { instance, tags: [...], intervalMin }. Every note
-// is still verified by dereference at its origin before it is mirrored.
-
-import { isContentType, authorOf } from '../core/intake/index.mjs';
-
-// A public timeline page from somebody else's instance. Generous for 20 posts,
-// and a bound where there was none.
-const MAX_TIMELINE_BYTES = 2 * 1024 * 1024;
-
-// Two tags from each of six subjects, so a new account reads something on the
-// first morning without having followed anybody. Deliberately even: a busy
-// subject and a quiet one get the same number of places, and the sweep below
-// makes sure the busy ones cannot take the quiet ones' turns as well.
-const DEFAULTS = {
-  instance: 'https://mastodon.social',
-  tags: [
-    'fediverse', 'activitypub',                  // the network this account is on
-    'opensource', 'foss',                        // how the software gets made
-    'solidproject', 'linkeddata',                // where the data lives
-    'privacy', 'digitalrights',                  // what is at stake
-    'indieweb', 'smallweb',                      // publishing for yourself
-    'commons', 'platformcooperativism',          // owning it together
-  ],
-  intervalMin: 15,
-};
-const PER_TAG = 20;              // statuses requested per tag per sweep
-const MAX_NEW_PER_SWEEP = 8;     // dereference budget per sweep — stay light
-// …and no one tag may take more than this much of it. Without a per-tag share
-// the budget was spent in list order: the first two or three busy tags used it
-// all and everything below them never appeared once, however long you waited.
-const MAX_NEW_PER_TAG = 2;
-// Only this many tags are polled in any one sweep, taken in turn. A sweep holds
-// its writes until it finishes — so on the browser build, where the agent lives
-// in a service worker the browser is free to kill whenever it likes, a sweep
-// that runs long enough to be killed contributes NOTHING. Twelve tags was long
-// enough: a new account could open the app repeatedly and still see an empty
-// timeline. Four finishes. The list is still covered, three sweeps at a time,
-// and a sweep now costs the gateway less than the three-tag one it replaced.
-const TAGS_PER_SWEEP = 4;
-const MAX_TAG_ENTRIES = 200;     // oldest tag entries pruned beyond this
-// The instance here is a stranger's server we poll on our own schedule, and it
-// has no other way to tell us to stop.
-const BACKOFF_MIN_MS = 15 * 60_000;
-const BACKOFF_MAX_MS = 6 * 60 * 60_000;
-const instanceRefusal = (status) => (status ? `the instance answered ${status}` : 'the instance did not answer');
-
-export class TagFeed {
-  constructor({ store, intake, log = console.log, fetcher = globalThis.fetch }) {
-    Object.assign(this, { store, intake, log, fetcher });
-    this.lastSweep = null;
-    this.lastAdded = 0;
-    // Where this sweep starts in the tag list. It moves on by one each time, so
-    // when the budget does run out it is a different tag that goes without.
-    this.cursor = 0;
-  }
-
-  config() { return { ...DEFAULTS, ...this.store.read('tagfeed.json', {}) }; }
-
-  setConfig(patch) {
-    const clean = {};
-    if (patch.instance) clean.instance = String(patch.instance).replace(/\/+$/, '');
-    if (Array.isArray(patch.tags)) clean.tags = patch.tags.map(t => String(t).replace(/^#/, '').trim()).filter(Boolean);
-    if (patch.intervalMin) clean.intervalMin = Math.max(5, Number(patch.intervalMin) || DEFAULTS.intervalMin);
-    this.store.write('tagfeed.json', { ...this.config(), ...clean });
-    this.stop();
-    this.start();
-    return this.config();
-  }
-
-  start() {
-    this.stopped = false;                     // restartable, the same way Intake.start is
-    this.sweep().catch(e => this.log(`tagfeed: ${e.message}`));
-    // Jittered and self-scheduling: every agent polling the same instance on
-    // the same 15-minute boundary is a beat nobody asked for.
-    const tick = () => {
-      this.timer = setTimeout(() => {
-        this.sweep()
-          .catch(e => this.log(`tagfeed: ${e.message}`))
-          .finally(() => { if (!this.stopped) tick(); });
-      }, Math.round(this.config().intervalMin * 60_000 * (0.85 + Math.random() * 0.3)));
-      this.timer.unref?.();
-    };
-    tick();
-  }
-
-  // The flag is what makes this stick. Clearing the timer only cancels a sweep
-  // that has not started: one already in flight re-arms itself in `finally`,
-  // and `this.stopped` was read there but never written — so a stop landing
-  // mid-sweep leaked that chain for the life of the process. Intake has had the
-  // flag all along; this is the same shape.
-  stop() { this.stopped = true; clearTimeout(this.timer); }
-
-  // Jittered exponential, capped, and cleared by an instance that answers.
-  // The next sweep is skipped rather than the timer stretched, so the tag
-  // config keeps meaning what it says once the far end is well again.
-  _backOff(status, retryAfter) {
-    this.failures = (this.failures || 0) + 1;
-    const ladder = Math.min(BACKOFF_MIN_MS * 2 ** (this.failures - 1), BACKOFF_MAX_MS);
-    const wait = retryAfter || Math.round(ladder * (0.85 + Math.random() * 0.3));
-    this.quietUntil = Date.now() + wait;
-    this.log(`tagfeed: ${instanceRefusal(status)} — not asking again for ${Math.round(wait / 60_000)} min`);
-  }
-
-  async sweep() {
-    const { instance, tags } = this.config();
-    if (!tags.length) return;
-    if (this.quietUntil && Date.now() < this.quietUntil) {
-      this.log(`tagfeed: still backing off for ${Math.round((this.quietUntil - Date.now()) / 60_000)} min`);
-      return;
-    }
-    this.lastSweep = new Date().toISOString();
-    const known = new Set(this.store.getStatuses().map(s => s.noteId));
-    let budget = MAX_NEW_PER_SWEEP;
-    let added = 0;
-    // A different handful every time, taken in turn, so no tag is permanently
-    // first and none is permanently last.
-    const start = this.cursor % tags.length;
-    this.cursor = (start + TAGS_PER_SWEEP) % tags.length;
-    const order = [...tags, ...tags].slice(start, start + Math.min(TAGS_PER_SWEEP, tags.length));
-    // The store's 300ms debounce cannot coalesce a sweep that awaits between
-    // items — every note costs a fetch to somebody else's server, which outlives
-    // the timer — so statuses.json and actors.json, the two largest documents,
-    // were serialized and PUT whole once per new note. On by default, every 15
-    // minutes, and on the browser build every one of those is a pod write.
-    // acctfeed has done it this way since 2026-08-03; this is the same fix.
-    this.store.hold?.();
-    try {
-    for (const tag of order) {
-      let perTag = MAX_NEW_PER_TAG;
-      let list;
-      try {
-        const { safeFetch, retryAfterMs, readCapped } = await import('../shared/safefetch.mjs');
-        const url = `${instance}/api/v1/timelines/tag/${encodeURIComponent(tag)}?limit=${PER_TAG}`;
-        const res = this.fetcher === globalThis.fetch
-          ? await safeFetch(url, { headers: { accept: 'application/json' } })
-          : await this.fetcher(url, { headers: { accept: 'application/json' } });
-        if (res.status >= 400) {
-          // This is somebody else's server, polled on OUR schedule, and it had
-          // no way to ask us to stop: a 429 or a 503 logged a line and the next
-          // sweep arrived on the same cadence regardless. One refusal now ends
-          // the sweep — the remaining tags are on the same instance, so there
-          // is nothing to be gained by asking them too.
-          this._backOff(res.status, retryAfterMs(res));
-          return;
-        }
-        // Somebody else's server, polled on our schedule: bounded, because
-        // res.json() would buffer a timeline of whatever size it sent.
-        list = JSON.parse(await readCapped(res, MAX_TIMELINE_BYTES));
-      } catch (e) {
-        // A network failure is the same signal, minus the courtesy.
-        this.log(`tagfeed #${tag}: ${e.message}`);
-        this._backOff(0, null);
-        return;
-      }
-      this.failures = 0;                      // it answered; the ladder resets
-      for (const st of Array.isArray(list) ? list : []) {
-        const noteId = st?.uri;
-        if (!noteId || known.has(noteId) || this.store.isBlocked(noteId)) continue;
-        if (perTag <= 0 || budget <= 0) break;
-        perTag--; budget--;
-        const note = await this.intake.fetchAP(noteId).catch(() => null);
-        if (!note || note.id !== noteId || !isContentType(note.type)) continue;
-        // The author is only known once the note is dereferenced, and this
-        // path never went through ingestNote, where that check lives. So a
-        // blocked account still reached the timeline by posting under a tag —
-        // the one route round a block the owner had explicitly set.
-        // The author is only known once the note is dereferenced, and this path
-        // never went through ingestNote, where that check lives. Two things
-        // followed: a blocked account reached the timeline by posting under a
-        // tag — the one route round a block the owner had explicitly set — and
-        // a note could name an author its own origin does not vouch for, which
-        // is the same forgery ingestNote refuses. No `delivered` fallback here:
-        // a tag-feed note has no envelope, so it names its author or it is not
-        // one we can attribute.
-        const author = authorOf(note);
-        if (!author || this.store.isBlocked(author)) continue;
-        if (!this.store.getActors()[author]) {
-          await this.intake.fetchAP(author).catch(() => {});   // warm name+avatar
-        }
-        const { attachmentsOf, titledContent } = await import('../core/wire.mjs');
-        const attachments = attachmentsOf(note);
-        this.store.addStatus({
-          noteId, actor: author, content: titledContent(note),
-          published: note.published, inReplyTo: note.inReplyTo, kind: 'tag', tag,
-          ...(attachments.length ? { attachments } : {}),
-        });
-        known.add(noteId);
-        added++;
-      }
-      // Nothing left to take, so stop asking. Every remaining tag would be a
-      // request whose answer is thrown away — and in the browser build every
-      // one of those goes out through the gateway.
-      if (budget <= 0) break;
-    }
-    const all = this.store.getStatuses();
-    const tagged = all.filter(s => s.kind === 'tag');
-    if (tagged.length > MAX_TAG_ENTRIES) {
-      const drop = new Set(tagged.slice(MAX_TAG_ENTRIES).map(s => s.noteId));   // arrival order: tail = oldest
-      this.store.write('statuses.json', all.filter(s => !drop.has(s.noteId)));
-    }
-    } finally {
-      this.store.release?.();
-    }
-    this.lastAdded = added;
-    if (added) this.log(`tagfeed: +${added} from #${order.join(' #')}`);
-  }
-}

package/lib/connections/vault.mjs

@@ -1,114 +0,0 @@
-// vault.mjs — where an identity keeps the credentials for accounts it holds on
-// OTHER servers: a full-access token on a Mastodon-API server, a Bluesky app
-// password. Not its own key, and nothing published.
-//
-// Two places, and which one is right depends on where the identity runs. On a
-// laptop the pod is somebody else's server, so a token goes on this machine
-// and nowhere near the pod. Inside a pod server the two are the same computer,
-// and the pod is the thing that travels — a token left on the host is a
-// connection the owner loses the day they take their pod elsewhere.
-//
-// The question is where the agent runs, not where its signing key is: sharing
-// a key through the pod is a laptop's own choice and says nothing about a
-// token for somebody else's server.
-//
-// `read`, `write` and `names` are synchronous because every caller here is.
-// The pod's writes land through the store's own retrying queue; `commit`
-// waits for them, and callers that have just taken a credential from a remote
-// server use it before they answer.
-import fs from 'node:fs';
-import path from 'node:path';
-import { writeJsonAtomic } from '../device/home.mjs';
-
-/** What every connection document in pod state is named from. */
-export const CONNECTION_PREFIX = 'conn-';
-
-/** One directory, one document per name, 0600 and atomic — the laptop. */
-export function fileVault(dir) {
-  const file = (name) => path.join(dir, `${name}.json`);
-  return {
-    kind: 'file',
-    where: dir,
-    names() {
-      try { return fs.readdirSync(dir).filter(n => n.endsWith('.json')).map(n => n.slice(0, -5)); }
-      catch { return []; }
-    },
-    read(name) {
-      try { return JSON.parse(fs.readFileSync(file(name), 'utf8')); } catch { return null; }
-    },
-    write(name, rec) {
-      fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-      writeJsonAtomic(file(name), rec);
-    },
-    async remove(name) {
-      try { fs.rmSync(file(name)); return true; } catch { return false; }
-    },
-    async commit() { return true; },
-  };
-}
-
-/** Documents in the identity's own pod state, one per name under `prefix`. */
-export function podVault(store, prefix) {
-  const doc = (name) => `${prefix}${name}.json`;
-  return {
-    kind: 'pod',
-    where: `pod state (${prefix}*)`,
-    names() {
-      return store.names()
-        .filter(n => n.startsWith(prefix) && n.endsWith('.json'))
-        .map(n => n.slice(prefix.length, -5));
-    },
-    read(name) { return store.read(doc(name), null); },
-    write(name, rec) { store.write(doc(name), rec); },
-    async remove(name) { return store.remove(doc(name)); },
-    async commit() { return store.commit(); },
-  };
-}
-
-/**
- * The vaults one agent's connections use.
- *
- * `embedded` is the whole question: an agent running inside the server that
- * holds its pod is on the pod's own host, so a credential left on the machine
- * is one its owner loses the day they take the pod elsewhere. An agent on a
- * laptop is not, and its tokens stay where they are — including when the
- * owner has chosen to share their SIGNING key through the pod, which says
- * nothing about a token for somebody else's server.
- */
-export function vaultsFor({ embedded, home, store }) {
-  if (!embedded) {
-    return { bluesky: null, fedi: null, apps: null };   // the classes' own defaults, beside the credential
-  }
-  return {
-    bluesky: podVault(store, CONNECTION_PREFIX),
-    fedi: podVault(store, `${CONNECTION_PREFIX}fedi-`),
-    apps: podVault(store, `${CONNECTION_PREFIX}fediapp-`),
-    home,
-  };
-}
-
-/**
- * Move whatever a file vault holds into a pod vault, and only then take the
- * host's copies away. A token here is full access to an account on a server
- * this project does not run: losing one in the move is a connection its owner
- * has to make again, and cannot be told about.
- */
-export async function moveVault(from, to, log = () => {}) {
-  const names = from.names();
-  if (!names.length) return 0;
-  let moved = 0;
-  for (const name of names) {
-    const rec = from.read(name);
-    if (!rec) continue;
-    if (to.read(name)) { await from.remove(name); continue; }
-    to.write(name, rec);
-    moved += 1;
-  }
-  if (!await to.commit()) {
-    log('could not write the connected-account credentials to the pod — they stay on this host for now');
-    return 0;
-  }
-  for (const name of names) await from.remove(name);
-  if (moved) log(`${moved} connected-account credential(s) moved into the pod`);
-  return moved;
-}